LexCheck Data Processing Addendum

• Subject Matter. This Addendum reflects the Parties’ commitment to abide by Applicable Data Protection Laws concerning the Processing of Customer Personal Data in connection with LexCheck’s execution of the Agreement. All capitalized terms that are not expressly defined in this Data Processing Addendum will have the meanings given to them in the Agreement. If and to the extent language in this Addendum or any of its Exhibits conflicts with the Agreement, this Addendum shall control.
• Duration and Survival. This Addendum will become legally binding upon the Effective Date of the Agreement or upon the date upon which both Parties have signed this Addendum, if it is completed after the Effective Date of the Agreement. LexCheck will Process Customer Personal Data until the relationship terminates as specified in the Agreement. LexCheck’s obligations and Customer’s rights under this Addendum will continue in effect so long as LexCheck Processes Customer Personal Data. 

2. Definitions.  

• “Applicable Data Protection Law(s)” means the relevant data protection and data privacy laws, rules and regulations to which the Customer Personal Data are subject. “Applicable Data Protections Law(s)” shall include, but not be limited to, EU General Data Protection Regulation 2016/679 (“GDPR”) principles and requirements.
• “Customer Personal Data” means Personal Data pertaining to Customer’s users or employees Processed by LexCheck. The Customer Personal Data and the specific uses of the Customer Personal Data are detailed in Exhibit 1 attached hereto, as required by the GDPR.
• “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
• “Personal Data” shall have the meaning assigned to the terms “personal data” or “personal information” under Applicable Data Protection Law(s).
• “Privacy Shield” collectively means the requirements of the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. 
• “Process,” “Processes,” “Processing,” “Processed” means any operation or set of operations which is performed on data or sets of data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
• “Processor” means a natural or legal person, public authority, agency or other body which Processes Customer Personal Data on behalf of Customer subject to this Addendum.
• “Security Incident(s)” means the breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data Processed by LexCheck.
• “Services” means any and all services that LexCheck performs under the Agreement.
• "Third Party(ies)” means LexCheck’s authorized contractors, agents, vendors and third party service providers that Process Customer Personal Data.

3. Data Use and Processing.

• Compliance with Laws.  Customer Personal Data shall be Processed in compliance with the terms of this Addendum and all Applicable Data Protection Law(s). 
• Documented Instructions. LexCheck and its Third Parties shall Process Customer Personal Data only in accordance with the documented instructions of Customer or as specifically authorized by this Addendum, the Agreement, or any applicable Statement of Work. LexCheck will, unless legally prohibited from doing so, inform Customer in writing if it reasonably believes that there is a conflict between Customer’s instructions and applicable law or otherwise seeks to Process Customer Personal Data in a manner that is inconsistent with Customer’s instructions.
• Authorization to Use Third Parties. To the extent necessary to fulfill LexCheck’s contractual obligations under the Agreement or any Statement of Work, Customer hereby authorizes (i) LexCheck to engage Third Parties and (ii) Third Parties to engage subprocessors. Any Third Party Processing of Customer Personal Data shall be consistent with Customer’s reasonable documented instructions and comply with all Applicable Data Protection Law(s).
• LexCheck and Third Party Compliance. LexCheck agrees to (i) enter into a written agreement with Third Parties regarding such Third Parties’ Processing of Customer Personal Data that imposes on such Third Parties (and their subprocessors) data protection and security requirements for Customer Personal Data that are compliant with Applicable Data Protection Law(s); and (ii) remain responsible to Customer for LexCheck’s Third Parties’ (and their subprocessors if applicable) failure to perform their obligations  with respect to the Processing of Customer Personal Data.
• Right to Object to Third Parties. LexCheck shall make available to Customer a list of Third Parties that Process Customer Personal Data upon reasonable request. Prior to engaging any new Third Parties that Process Customer Personal Data, LexCheck will notify Customer via email and allow Customer thirty (30) days to object. If Customer has legitimate objections to the appointment of any new Third Party, the parties will work together in good faith to resolve the grounds for the objection for no less than thirty (30) days, and failing any such resolution, Customer may terminate the part of the service performed under the Agreement that cannot be performed by LexCheck without use of the objectionable Third Party. LexCheck shall refund any pre-paid fees to Customer in respect of the terminated part of the Service.
• Confidentiality. Any person or Third Party authorized to Process Customer Personal Data must agree to maintain the confidentiality of such information or be under an appropriate statutory or contractual obligation of confidentiality.
• Personal Data Inquiries and Requests. LexCheck agrees to comply with all reasonable instructions from Customer related to any requests from individuals exercising their rights in Personal Data granted to them under Applicable Data Protection Law(s) (“Privacy Request”). At Customer’s request and without undue delay, LexCheck agrees to assist Customer in answering or complying with any Privacy Request in so far as it is possible.
• Data Protection Impact Assessment and Prior Consultation. LexCheck agrees to provide reasonable assistance at Customer’s expense to Customer where, in Customer’s judgement, the type of Processing performed by LexCheck is likely to result in a high risk to the rights and freedoms of natural persons (e.g., systematic and extensive profiling, Processing sensitive Personal Data on a large scale and systematic monitoring on a large scale, or where the Processing uses new technologies) and thus requires a data protection impact assessment and/or prior consultation with the relevant data protection authorities.
• Demonstrable Compliance. LexCheck agrees to keep records of its Processing in compliance with Applicable Data Protection Law(s) and provide any necessary records to Customer to demonstrate compliance upon reasonable request. 

4. Cross-Border Transfers of Personal Data. 

• Cross-Border Transfers of Personal Data. Customer authorizes LexCheck and its Third Parties to transfer Customer Personal Data across international borders, including from the European Economic Area to the United States. Any cross-border transfer of Customer Personal Data must be supported by an approved adequacy mechanism.
• Standard Contractual Clauses. LexCheck and Customer will use the European Commission
• 
  Decision C(2010)593 Standard Contractual Clauses for Controllers to Processors (“Model Clauses”) as the adequacy mechanism supporting the transfer and Processing of Customer Personal Data, the terms of which are herein incorporated by reference and made part hereto. Under Appendix 1 of the Model Clauses, the “data exporter” is Customer and the “data importer” is LexCheck and the information required by Appendix 1 can be found in Exhibit 1. For the purposes of Appendix 2 of the Model Clauses, the technical and organizational measures implemented by the data importer are those listed in Section 5 of this Addendum. Pursuant to clause 5(h) of the Model Clauses, Company agrees that LexCheck may engage new Third Parties in accordance with Section(s) 3(c) – 3(e) of this Addendum. The Parties agree that the Illustrative
  
  Clause (Optional) is expressly not included in the Model Clauses. Each party’s signature to this Addendum shall be considered a signature to the Model Clauses. If required by the laws or regulatory procedures of any jurisdiction, the Parties shall execute or re-execute the Model Clauses as separate documents.

5. Information Security Program.

• LexCheck agrees to implement appropriate technical and organizational measures designed to protect Customer Personal Data as required by Applicable Data Protection Law(s) (the “Information Security Program”). Such measures shall be designed to include: 

• Pseudonymisation of Customer Personal Data where appropriate, and encryption of Customer Personal Data in transit and at rest;
• The ability to ensure the ongoing confidentiality, integrity, availability of LexCheck’s Processing and Customer Personal Data;
• The ability to restore the availability and access to Customer Personal Data in the event of a physical or technical incident;
• A process for regularly testing, assessing and evaluating of the effectiveness of the LexCheck’s Information Security Program to ensure the security of Customer Personal Data from reasonably suspected or actual accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.